program:
syz_usb_connect(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYRES64=0x0, @ANYRESDEC], 0x0) (async)
syz_usb_connect(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYRES64=0x0, @ANYRESDEC], 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000240)=@urb_type_iso={0x0, {0x5}, 0x3, 0x80, 0x0, 0x0, 0x2, 0x6512c6de, 0x4, 0xc, 0x100, 0x0})
ioctl$USBDEVFS_REAPURB(r0, 0x4008550c, &(0x7f0000000040))
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20a00, 0x0) (async)
r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20a00, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301)
ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) (async)
ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200))
ioctl$USBDEVFS_IOCTL(r2, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
recvmmsg(r3, &(0x7f0000007a00)=[{{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0xfffffffc}, {{0x0, 0x0, 0x0}, 0xffff1285}], 0x3, 0x20000, 0x0) (async)
recvmmsg(r3, &(0x7f0000007a00)=[{{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0xfffffffc}, {{0x0, 0x0, 0x0}, 0xffff1285}], 0x3, 0x20000, 0x0)
sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}}, 0x0)
sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000005900)={0x14, 0x15, 0xa, 0x201}, 0x14}}, 0x0)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000740)=@urb_type_bulk={0x3, {0xd}, 0xb03, 0x1, 0x0, 0x0, 0x8, 0x4, 0x3, 0x4, 0x800, 0x0})
ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f0000000100)={0x8}) (async)
ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, &(0x7f0000000100)={0x8})
[ 75.285919][ T4661] Bluetooth: hci0: command tx timeout
[ 75.367903][ T5316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 75.373260][ T5317] sysfs: cannot create duplicate filename '/module/raw_gadget'
[ 75.379436][ T5316] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 75.382719][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full)
[ 75.382734][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 75.382741][ T5317] Call Trace:
[ 75.382746][ T5317]
[ 75.382751][ T5317] dump_stack_lvl+0x189/0x250
[ 75.382860][ T5317] ? __pfx_dump_stack_lvl+0x10/0x10
[ 75.382873][ T5317] ? __pfx__printk+0x10/0x10
[ 75.382884][ T5317] ? kernfs_path_from_node+0x2b/0x260
[ 75.382935][ T5317] ? kernfs_path_from_node+0x2b/0x260
[ 75.382946][ T5317] ? kernfs_path_from_node+0x2b/0x260
[ 75.382959][ T5317] ? kernfs_path_from_node+0x216/0x260
[ 75.382973][ T5317] sysfs_create_dir_ns+0x259/0x280
[ 75.382987][ T5317] ? __pfx_sysfs_create_dir_ns+0x10/0x10
[ 75.383001][ T5317] ? do_raw_spin_unlock+0x4d/0x240
[ 75.383015][ T5317] kobject_add_internal+0x59f/0xb40
[ 75.383061][ T5317] kobject_init_and_add+0x125/0x190
[ 75.383076][ T5317] ? __pfx_kobject_init_and_add+0x10/0x10
[ 75.383089][ T5317] ? __kasan_kmalloc+0x93/0xb0
[ 75.383102][ T5317] ? __kmalloc_cache_noprof+0x230/0x3d0
[ 75.383114][ T5317] ? lookup_or_create_module_kobject+0x75/0x170
[ 75.383126][ T5317] lookup_or_create_module_kobject+0xe3/0x170
[ 75.383136][ T5317] module_add_driver+0xb9/0x310
[ 75.383152][ T5317] bus_add_driver+0x391/0x640
[ 75.383167][ T5317] driver_register+0x23a/0x320
[ 75.383182][ T5317] usb_gadget_register_driver_owner+0xf9/0x270
[ 75.383198][ T5317] raw_ioctl+0x149a/0x3c90
[ 75.383212][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0
[ 75.383234][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0
[ 75.383248][ T5317] ? tomoyo_path_number_perm+0x4e2/0x5a0
[ 75.383261][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0
[ 75.383276][ T5317] ? __pfx_raw_ioctl+0x10/0x10
[ 75.383293][ T5317] ? count_memcg_event_mm+0x92/0x3b0
[ 75.383304][ T5317] ? __lock_acquire+0xaac/0xd20
[ 75.383324][ T5317] ? __fget_files+0x2a/0x420
[ 75.383338][ T5317] ? __fget_files+0x3a0/0x420
[ 75.383348][ T5317] ? __fget_files+0x2a/0x420
[ 75.383362][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20
[ 75.383374][ T5317] ? __pfx_raw_ioctl+0x10/0x10
[ 75.383384][ T5317] __se_sys_ioctl+0xf9/0x170
[ 75.383394][ T5317] do_syscall_64+0xf6/0x210
[ 75.383404][ T5317] ? clear_bhb_loop+0x45/0xa0
[ 75.383415][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.383425][ T5317] RIP: 0033:0x7f3da338e56b
[ 75.383435][ T5317] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 75.383443][ T5317] RSP: 002b:00007f3da417af10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 75.383454][ T5317] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f3da338e56b
[ 75.383460][ T5317] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004
[ 75.383465][ T5317] RBP: 00007f3da417bfe0 R08: 0000000000000000 R09: 00302e6364755f79
[ 75.383471][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 75.383477][ T5317] R13: 00007f3da417afb0 R14: 00002000000000c0 R15: 00007f3da36e0320
[ 75.383493][ T5317]
[ 75.383513][ T5317] kobject: kobject_add_internal failed for raw_gadget with -EEXIST, don't try to register things with the same name in the same directory.
[ 75.523057][ T5317] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
[ 75.527690][ T5317] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
[ 75.530911][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full)
[ 75.535273][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 75.539696][ T5317] RIP: 0010:kasan_byte_accessible+0x12/0x30
[ 75.542178][ T5317] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e
[ 75.550065][ T5317] RSP: 0018:ffffc9000fe2f840 EFLAGS: 00010002
[ 75.552636][ T5317] RAX: dffffc0000000000 RBX: ffffffff8b588807 RCX: 33c146b5eeb28700
[ 75.556002][ T5317] RDX: 0000000000000000 RSI: ffffffff8b588807 RDI: 0000000000000004
[ 75.559247][ T5317] RBP: ffffffff819b49d8 R08: 0000000000000001 R09: 0000000000000000
[ 75.562481][ T5317] R10: dffffc0000000000 R11: fffffbfff1efda2f R12: 0000000000000000
[ 75.565664][ T5317] R13: 0000000000000020 R14: 0000000000000020 R15: 0000000000000001
[ 75.568935][ T5317] FS: 00007f3da417d6c0(0000) GS:ffff88808d6cc000(0000) knlGS:0000000000000000
[ 75.572549][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 75.574955][ T5317] CR2: 00007f3da419cfe0 CR3: 0000000043454000 CR4: 0000000000352ef0
[ 75.578747][ T5317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 75.581660][ T5317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 75.584884][ T5317] Call Trace:
[ 75.586236][ T5317]
[ 75.587439][ T5317] __kasan_check_byte+0x12/0x40
[ 75.589471][ T5317] lock_acquire+0x8d/0x360
[ 75.591232][ T5317] ? kobj_kset_leave+0x163/0x190
[ 75.593265][ T5317] _raw_spin_lock_irqsave+0xa7/0xf0
[ 75.595438][ T5317] ? complete+0x28/0x1b0
[ 75.597187][ T5317] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 75.599650][ T5317] ? kobject_init_and_add+0x125/0x190
[ 75.601916][ T5317] complete+0x28/0x1b0
[ 75.603600][ T5317] kobject_put+0x228/0x480
[ 75.605405][ T5317] lookup_or_create_module_kobject+0x150/0x170
[ 75.607910][ T5317] module_add_driver+0xb9/0x310
[ 75.609910][ T5317] bus_add_driver+0x391/0x640
[ 75.611839][ T5317] driver_register+0x23a/0x320
[ 75.613757][ T5317] usb_gadget_register_driver_owner+0xf9/0x270
[ 75.616247][ T5317] raw_ioctl+0x149a/0x3c90
[ 75.618260][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0
[ 75.620405][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0
[ 75.622531][ T5317] ? tomoyo_path_number_perm+0x4e2/0x5a0
[ 75.624787][ T5317] ? tomoyo_path_number_perm+0x1bc/0x5a0
[ 75.626885][ T5317] ? __pfx_raw_ioctl+0x10/0x10
[ 75.629212][ T5317] ? count_memcg_event_mm+0x92/0x3b0
[ 75.631497][ T5317] ? __lock_acquire+0xaac/0xd20
[ 75.633688][ T5317] ? __fget_files+0x2a/0x420
[ 75.636259][ T5317] ? __fget_files+0x3a0/0x420
[ 75.638298][ T5317] ? __fget_files+0x2a/0x420
[ 75.640225][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20
[ 75.642187][ T5317] ? __pfx_raw_ioctl+0x10/0x10
[ 75.644070][ T5317] __se_sys_ioctl+0xf9/0x170
[ 75.646048][ T5317] do_syscall_64+0xf6/0x210
[ 75.647952][ T5317] ? clear_bhb_loop+0x45/0xa0
[ 75.649998][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.652414][ T5317] RIP: 0033:0x7f3da338e56b
[ 75.654102][ T5317] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 75.661777][ T5317] RSP: 002b:00007f3da417af10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 75.665310][ T5317] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f3da338e56b
[ 75.668550][ T5317] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004
[ 75.671913][ T5317] RBP: 00007f3da417bfe0 R08: 0000000000000000 R09: 00302e6364755f79
[ 75.675009][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 75.678192][ T5317] R13: 00007f3da417afb0 R14: 00002000000000c0 R15: 00007f3da36e0320
[ 75.681440][ T5317]
[ 75.682824][ T5317] Modules linked in:
[ 75.684486][ T5317] ---[ end trace 0000000000000000 ]---
[ 75.686679][ T5317] RIP: 0010:kasan_byte_accessible+0x12/0x30
[ 75.689103][ T5317] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e
[ 75.696752][ T5317] RSP: 0018:ffffc9000fe2f840 EFLAGS: 00010002
[ 75.699249][ T5317] RAX: dffffc0000000000 RBX: ffffffff8b588807 RCX: 33c146b5eeb28700
[ 75.702423][ T5317] RDX: 0000000000000000 RSI: ffffffff8b588807 RDI: 0000000000000004
[ 75.705785][ T5317] RBP: ffffffff819b49d8 R08: 0000000000000001 R09: 0000000000000000
[ 75.709124][ T5317] R10: dffffc0000000000 R11: fffffbfff1efda2f R12: 0000000000000000
[ 75.712587][ T5317] R13: 0000000000000020 R14: 0000000000000020 R15: 0000000000000001
[ 75.716082][ T5317] FS: 00007f3da417d6c0(0000) GS:ffff88808d6cc000(0000) knlGS:0000000000000000
[ 75.719635][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 75.722231][ T5317] CR2: 00007f3da419cfe0 CR3: 0000000043454000 CR4: 0000000000352ef0
[ 75.725295][ T5317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 75.728615][ T5317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 75.732112][ T5317] Kernel panic - not syncing: Fatal exception
[ 75.734976][ T5317] Kernel Offset: disabled
[ 75.736828][ T5317] Rebooting in 86400 seconds..